rtl8723bs WPS copy bug allows remote stack overflow on scan

A stack buffer overflow in the staging rtl8723bs Wi-Fi driver can be triggered by a crafted beacon or probe response, giving an unauthenticated attacker in radio range a path to crash or corrupt the kernel during ordinary network scans.

The flaw sits in code that extracts WPS attributes from information elements carried in those frames. The attribute length field is taken from the air and used as the size of a memcpy into a caller-supplied buffer, with no check against that buffer's actual capacity. Call sites that handle the single-byte Selected Registrar attribute pass a one-byte stack variable, so a frame that advertises a longer attribute overruns the stack. Scans run automatically under NetworkManager or iwd, so no user action is required beyond having the adapter up.

An earlier change tightened bounds checks on WPS attribute headers but left the content copy unbounded, so both an out-of-bounds read of the element and an out-of-bounds write to the destination remained. Jesus Olmos reported the gap and posted a patch that rejects attributes longer than the enclosing element, passes the destination size into the content helper, and clamps the copy.

Greg Kroah-Hartman, reviewing on the kernel list, questioned whether the change had been tested on real hardware, asked about tooling attribution, and said the patch as written appeared to contain an endless loop. The driver remains in staging; until a corrected fix lands and reaches stable kernels, systems using rtl8723bs stay exposed to adjacent unauthenticated overflow on scan.